September 2013 - openSUSE Updates - openSUSE Mailing Lists

openSUSE-SU-2013:1444-1: moderate: squid3
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: squid3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1444-1 Rating: moderate References: #677335 #829084 Cross-References: CVE-2013-4115 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This squid3 update includes several security fixes and minor changes. - squid-3.1.x-bnc829084-CVE-2013-4115-BO_request_handling.diff Squid advisory SQUID-2013_2, CVE-2013-4115, [bnc#829084] Specially crafted http requests can trigger a buffer overflow when squid attempts to resolve an overly long hostname. - run logrotate as squid:nogroup [bnc#677335] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-133 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid3-3.1.23-19.1 squid3-debuginfo-3.1.23-19.1 squid3-debugsource-3.1.23-19.1 References: http://support.novell.com/security/cve/CVE-2013-4115.html https://bugzilla.novell.com/677335 https://bugzilla.novell.com/829084

1 0

openSUSE-SU-2013:1443-1: moderate: squid
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1443-1 Rating: moderate References: #677335 #796999 #829084 Cross-References: CVE-2012-5643 CVE-2013-0188 CVE-2013-0189 CVE-2013-4115 Affected Products: openSUSE 11.4 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This squid update includes several security fixes and minor changes. - squid-2.7.x-bnc829084-CVE-2013-4115-BO_request_handling.diff Squid advisory SQUID-2013_2, CVE-2013-4115, [bnc#829084] Specially crafted http requests can trigger a buffer overflow when squid attempts to resolve an overly long hostname. - squid-2.7.x-bnc796999-bnc794954-CVE-2012-5643-CVE-2013-0188- cachemgr_cgi_dos.diff memory leak in cachemgr.cgi known as CVE-2013-0189, which is the underfixed CVE-2012-5643 problem. [bnc#796999] [bnc#794954] - run logrotate as squid:nogroup [bnc#677335] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 11.4: zypper in -t patch 2013-132 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 11.4 (i586 x86_64): squid-2.7.STABLE6-10.17.1 squid-debuginfo-2.7.STABLE6-10.17.1 squid-debugsource-2.7.STABLE6-10.17.1 References: http://support.novell.com/security/cve/CVE-2012-5643.html http://support.novell.com/security/cve/CVE-2013-0188.html http://support.novell.com/security/cve/CVE-2013-0189.html http://support.novell.com/security/cve/CVE-2013-4115.html https://bugzilla.novell.com/677335 https://bugzilla.novell.com/796999 https://bugzilla.novell.com/829084

1 0

openSUSE-SU-2013:1442-1: moderate: update for subversion
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for subversion ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1442-1 Rating: moderate References: #836245 Cross-References: CVE-2013-4277 Affected Products: openSUSE 12.3 openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This subversion update includes a security fix and several minor changes. - update to 1.7.13 [bnc#836245] - User-visible changes: - General * merge: fix bogus mergeinfo with conflicting file merges * diff: fix duplicated path component in '--summarize' output * ra_serf: ignore case when checking certificate common names - Server-side bugfixes: * svnserve: fix creation of pid files CVE-2013-4277 * mod_dav_svn: better status codes for commit failures * mod_dav_svn: do not map requests to filesystem - Developer-visible changes: - General: * don't use uninitialized variable to produce an error code - Bindings: * swig-pl: fix SVN::Client not honoring config file settings * swig-pl & swig-py: disable unusable svn_fs_set_warning_func Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-701 - openSUSE 12.2: zypper in -t patch openSUSE-2013-701 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.7.13-2.16.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.13-2.16.1 libsvn_auth_kwallet-1-0-1.7.13-2.16.1 libsvn_auth_kwallet-1-0-debuginfo-1.7.13-2.16.1 subversion-1.7.13-2.16.1 subversion-debuginfo-1.7.13-2.16.1 subversion-debugsource-1.7.13-2.16.1 subversion-devel-1.7.13-2.16.1 subversion-perl-1.7.13-2.16.1 subversion-perl-debuginfo-1.7.13-2.16.1 subversion-python-1.7.13-2.16.1 subversion-python-debuginfo-1.7.13-2.16.1 subversion-server-1.7.13-2.16.1 subversion-server-debuginfo-1.7.13-2.16.1 subversion-tools-1.7.13-2.16.1 subversion-tools-debuginfo-1.7.13-2.16.1 - openSUSE 12.3 (noarch): subversion-bash-completion-1.7.13-2.16.1 - openSUSE 12.2 (i586 x86_64): libsvn_auth_gnome_keyring-1-0-1.7.13-4.24.1 libsvn_auth_gnome_keyring-1-0-debuginfo-1.7.13-4.24.1 libsvn_auth_kwallet-1-0-1.7.13-4.24.1 libsvn_auth_kwallet-1-0-debuginfo-1.7.13-4.24.1 subversion-1.7.13-4.24.1 subversion-debuginfo-1.7.13-4.24.1 subversion-debugsource-1.7.13-4.24.1 subversion-devel-1.7.13-4.24.1 subversion-perl-1.7.13-4.24.1 subversion-perl-debuginfo-1.7.13-4.24.1 subversion-python-1.7.13-4.24.1 subversion-python-debuginfo-1.7.13-4.24.1 subversion-server-1.7.13-4.24.1 subversion-server-debuginfo-1.7.13-4.24.1 subversion-tools-1.7.13-4.24.1 subversion-tools-debuginfo-1.7.13-4.24.1 - openSUSE 12.2 (noarch): subversion-bash-completion-1.7.13-4.24.1 References: http://support.novell.com/security/cve/CVE-2013-4277.html https://bugzilla.novell.com/836245

1 0

openSUSE-SU-2013:1441-1: moderate: update for squid3
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for squid3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1441-1 Rating: moderate References: #677335 #829084 Cross-References: CVE-2013-4115 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This squid3 update includes several security fixes and minor changes. - squid-3.1.x-bnc829084-CVE-2013-4115-BO_request_handling.diff Squid advisory SQUID-2013_2, CVE-2013-4115, [bnc#829084] Specially crafted http requests can trigger a buffer overflow when squid attempts to resolve an overly long hostname. - run logrotate as squid:nogroup [bnc#677335] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-700 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): squid3-3.1.23-2.8.1 squid3-debuginfo-3.1.23-2.8.1 squid3-debugsource-3.1.23-2.8.1 References: http://support.novell.com/security/cve/CVE-2013-4115.html https://bugzilla.novell.com/677335 https://bugzilla.novell.com/829084

1 0

openSUSE-SU-2013:1440-1: moderate: update for python
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1440-1 Rating: moderate References: #766778 #834601 Cross-References: CVE-2013-4238 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that solves one vulnerability and has one errata is now available. Description: This python update includes a SSL certificates fix and other minor fixes. - disable test_io completely on ppc/ppc64 - handle NULL bytes in certain fields of SSL certificates (CVE-2013-4238, bnc#834601, CVE-2013-4238_py27.patch) - python & python-base Release numbers can differ, take that into account. See bnc#766778 comment 12. Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-694 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libpython2_7-1_0-2.7.3-3.9.1 libpython2_7-1_0-debuginfo-2.7.3-3.9.1 python-2.7.3-3.9.1 python-base-2.7.3-3.9.1 python-base-debuginfo-2.7.3-3.9.1 python-base-debugsource-2.7.3-3.9.1 python-curses-2.7.3-3.9.1 python-curses-debuginfo-2.7.3-3.9.1 python-debuginfo-2.7.3-3.9.1 python-debugsource-2.7.3-3.9.1 python-demo-2.7.3-3.9.1 python-devel-2.7.3-3.9.1 python-gdbm-2.7.3-3.9.1 python-gdbm-debuginfo-2.7.3-3.9.1 python-idle-2.7.3-3.9.1 python-tk-2.7.3-3.9.1 python-tk-debuginfo-2.7.3-3.9.1 python-xml-2.7.3-3.9.1 python-xml-debuginfo-2.7.3-3.9.1 - openSUSE 12.2 (x86_64): libpython2_7-1_0-32bit-2.7.3-3.9.1 libpython2_7-1_0-debuginfo-32bit-2.7.3-3.9.1 python-32bit-2.7.3-3.9.1 python-base-32bit-2.7.3-3.9.1 python-base-debuginfo-32bit-2.7.3-3.9.1 python-debuginfo-32bit-2.7.3-3.9.1 - openSUSE 12.2 (noarch): python-doc-2.7-3.9.1 python-doc-pdf-2.7-3.9.1 References: http://support.novell.com/security/cve/CVE-2013-4238.html https://bugzilla.novell.com/766778 https://bugzilla.novell.com/834601

1 0

openSUSE-SU-2013:1439-1: moderate: update for python3
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1439-1 Rating: moderate References: #834601 Cross-References: CVE-2013-4238 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update includes a SSL certificates fix. - handle NULL bytes in certain fields of SSL certificates (CVE-2013-4238, bnc#834601, CVE-2013-4238_py33.patch) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-697 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libpython3_3m1_0-3.3.0-6.11.3 libpython3_3m1_0-debuginfo-3.3.0-6.11.3 python3-3.3.0-6.11.1 python3-base-3.3.0-6.11.3 python3-base-debuginfo-3.3.0-6.11.3 python3-base-debugsource-3.3.0-6.11.3 python3-curses-3.3.0-6.11.1 python3-curses-debuginfo-3.3.0-6.11.1 python3-dbm-3.3.0-6.11.1 python3-dbm-debuginfo-3.3.0-6.11.1 python3-debuginfo-3.3.0-6.11.1 python3-debugsource-3.3.0-6.11.1 python3-devel-3.3.0-6.11.3 python3-devel-debuginfo-3.3.0-6.11.3 python3-idle-3.3.0-6.11.3 python3-testsuite-3.3.0-6.11.3 python3-testsuite-debuginfo-3.3.0-6.11.3 python3-tk-3.3.0-6.11.1 python3-tk-debuginfo-3.3.0-6.11.1 python3-tools-3.3.0-6.11.3 - openSUSE 12.3 (x86_64): libpython3_3m1_0-32bit-3.3.0-6.11.3 libpython3_3m1_0-debuginfo-32bit-3.3.0-6.11.3 python3-32bit-3.3.0-6.11.1 python3-base-32bit-3.3.0-6.11.3 python3-base-debuginfo-32bit-3.3.0-6.11.3 python3-debuginfo-32bit-3.3.0-6.11.1 - openSUSE 12.3 (noarch): python3-doc-3.3.0-6.11.1 python3-doc-pdf-3.3.0-6.11.1 References: http://support.novell.com/security/cve/CVE-2013-4238.html https://bugzilla.novell.com/834601

1 0

openSUSE-SU-2013:1438-1: moderate: update for python
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for python ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1438-1 Rating: moderate References: #834601 Cross-References: CVE-2013-4238 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update includes a SSL certificates fix. - handle NULL bytes in certain fields of SSL certificates (CVE-2013-4238, bnc#834601, CVE-2013-4238_py27.patch) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-696 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): libpython2_7-1_0-2.7.3-10.8.1 libpython2_7-1_0-debuginfo-2.7.3-10.8.1 python-2.7.3-10.8.1 python-base-2.7.3-10.8.1 python-base-debuginfo-2.7.3-10.8.1 python-base-debugsource-2.7.3-10.8.1 python-curses-2.7.3-10.8.1 python-curses-debuginfo-2.7.3-10.8.1 python-debuginfo-2.7.3-10.8.1 python-debugsource-2.7.3-10.8.1 python-demo-2.7.3-10.8.1 python-devel-2.7.3-10.8.1 python-gdbm-2.7.3-10.8.1 python-gdbm-debuginfo-2.7.3-10.8.1 python-idle-2.7.3-10.8.1 python-tk-2.7.3-10.8.1 python-tk-debuginfo-2.7.3-10.8.1 python-xml-2.7.3-10.8.1 python-xml-debuginfo-2.7.3-10.8.1 - openSUSE 12.3 (x86_64): libpython2_7-1_0-32bit-2.7.3-10.8.1 libpython2_7-1_0-debuginfo-32bit-2.7.3-10.8.1 python-32bit-2.7.3-10.8.1 python-base-32bit-2.7.3-10.8.1 python-base-debuginfo-32bit-2.7.3-10.8.1 python-debuginfo-32bit-2.7.3-10.8.1 - openSUSE 12.3 (noarch): python-doc-2.7-10.8.1 python-doc-pdf-2.7-10.8.1 References: http://support.novell.com/security/cve/CVE-2013-4238.html https://bugzilla.novell.com/834601

1 0

openSUSE-SU-2013:1437-1: moderate: update for python3
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for python3 ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1437-1 Rating: moderate References: #834601 Cross-References: CVE-2013-4238 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes one vulnerability is now available. Description: This python update includes a SSL certificates fix and other minor changes. - disable test_io on ppc* as it hangs - handle NULL bytes in certain fields of SSL certificates (CVE-2013-4238, bnc#834601, CVE-2013-4238-py32.patch) Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-695 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): libpython3_2mu1_0-3.2.3-1.4.1 libpython3_2mu1_0-debuginfo-3.2.3-1.4.1 python3-2to3-3.2.3-1.4.1 python3-3.2.3-1.4.1 python3-base-3.2.3-1.4.1 python3-base-debuginfo-3.2.3-1.4.1 python3-base-debugsource-3.2.3-1.4.1 python3-curses-3.2.3-1.4.1 python3-curses-debuginfo-3.2.3-1.4.1 python3-dbm-3.2.3-1.4.1 python3-dbm-debuginfo-3.2.3-1.4.1 python3-debuginfo-3.2.3-1.4.1 python3-debugsource-3.2.3-1.4.1 python3-devel-3.2.3-1.4.1 python3-idle-3.2.3-1.4.1 python3-testsuite-3.2.3-1.4.1 python3-testsuite-debuginfo-3.2.3-1.4.1 python3-tk-3.2.3-1.4.1 python3-tk-debuginfo-3.2.3-1.4.1 python3-tools-3.2.3-1.4.1 python3-xml-3.2.3-1.4.1 python3-xml-debuginfo-3.2.3-1.4.1 - openSUSE 12.2 (x86_64): libpython3_2mu1_0-32bit-3.2.3-1.4.1 libpython3_2mu1_0-debuginfo-32bit-3.2.3-1.4.1 python3-32bit-3.2.3-1.4.1 python3-debuginfo-32bit-3.2.3-1.4.1 - openSUSE 12.2 (noarch): python3-doc-3.2-1.4.1 python3-doc-pdf-3.2-1.4.1 References: http://support.novell.com/security/cve/CVE-2013-4238.html https://bugzilla.novell.com/834601

1 0

openSUSE-SU-2013:1436-1: moderate: update for squid
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1436-1 Rating: moderate References: #677335 #794954 #796999 #829084 Cross-References: CVE-2012-5643 CVE-2013-0188 CVE-2013-0189 CVE-2013-4115 Affected Products: openSUSE 12.2 ______________________________________________________________________________ An update that fixes four vulnerabilities is now available. Description: This squid update includes several security fixes and minor changes. - squid-2.7.x-bnc829084-CVE-2013-4115-BO_request_handling.diff Squid advisory SQUID-2013_2, CVE-2013-4115, [bnc#829084] Specially crafted http requests can trigger a buffer overflow when squid attempts to resolve an overly long hostname. - squid-2.7.x-bnc796999-bnc794954-CVE-2012-5643-CVE-2013-0188- cachemgr_cgi_dos.diff memory leak in cachemgr.cgi known as CVE-2013-0189, which is the underfixed CVE-2012-5643 problem. [bnc#796999] [bnc#794954] - run logrotate as squid:nogroup [bnc#677335] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.2: zypper in -t patch openSUSE-2013-698 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.2 (i586 x86_64): squid-2.7.STABLE9-9.4.1 squid-debuginfo-2.7.STABLE9-9.4.1 squid-debugsource-2.7.STABLE9-9.4.1 References: http://support.novell.com/security/cve/CVE-2012-5643.html http://support.novell.com/security/cve/CVE-2013-0188.html http://support.novell.com/security/cve/CVE-2013-0189.html http://support.novell.com/security/cve/CVE-2013-4115.html https://bugzilla.novell.com/677335 https://bugzilla.novell.com/794954 https://bugzilla.novell.com/796999 https://bugzilla.novell.com/829084

1 0

openSUSE-SU-2013:1435-1: moderate: update for squid
by opensuse-security＠opensuse.org 13 Sep '13

13 Sep '13

openSUSE Security Update: update for squid ______________________________________________________________________________ Announcement ID: openSUSE-SU-2013:1435-1 Rating: moderate References: #677335 #829084 #830319 Cross-References: CVE-2013-4115 CVE-2013-4123 Affected Products: openSUSE 12.3 ______________________________________________________________________________ An update that solves two vulnerabilities and has one errata is now available. Description: This squid update includes several security fixes and minor changes. - squid-3.2.x-11823-bnc829084-CVE-2013-4115.diff fixes a buffer overflow involving very long hostnames. [bnc#829084] CVE-2013-4115 - squid-3.2.x-11823-bnc830319-CVE-2013-4123.diff fixes problems identifying a port number as specified by the client. [bnc#830319] CVE-2013-4123 - run logrotate as squid:nogroup [bnc#677335] Patch Instructions: To install this openSUSE Security Update use YaST online_update. Alternatively you can run the command listed for your product: - openSUSE 12.3: zypper in -t patch openSUSE-2013-699 To bring your system up-to-date, use "zypper patch". Package List: - openSUSE 12.3 (i586 x86_64): squid-3.2.11-3.8.1 squid-debuginfo-3.2.11-3.8.1 squid-debugsource-3.2.11-3.8.1 References: http://support.novell.com/security/cve/CVE-2013-4115.html http://support.novell.com/security/cve/CVE-2013-4123.html https://bugzilla.novell.com/677335 https://bugzilla.novell.com/829084 https://bugzilla.novell.com/830319

1 0